Thread: [Simpleweb-Support] [newbie] SSL Handshake

SourceForge Headquarters 225 Broadway Suite 1600 San Diego, CA 92101 +1 (858) 422-6466

Dear all,

How can I make a web server that needed Client Keystore for making SSL
Handshake process??

Thank you

Rahmat Bagas Santoso.

Hi, 

I have implemented a basic enough server using Simple, it is located at
http://mambaweb.sourceforge.net/, this implements the server with SSL
connections. You can find the source for it within the mamba-1.1.jar
file.

Niall

On Tue, 2004-04-27 at 09:09, bagas wrote:
> Dear all,
> 
>  
> 
> How can I make a web server that needed Client Keystore for making SSL
> Handshake process??
> 
>  
> 
> Thank you
> 
>  
> 
>  
> 
> Rahmat Bagas Santoso.
> 
> 

Thank you for your reply.

I have read mamba (http://mambaweb.sourceforge.net) source if I am not
mistaken (please correct me if I am wrong) it only use server
authentication so that the client can verify that the site is who and
what it claims to be. But if the server would like to request a
certificate to verify that the client is who and what it claims to be
(client authentication) how can I do this?

Thank you again,

Rahmat Bagas Santoso

-----Original Message-----
From: sim...@li...
[mailto:sim...@li...] On Behalf Of
Niall Gallagher
Sent: Tuesday, April 27, 2004 4:31 PM
To: sim...@li...
Subject: Re: [Simpleweb-Support] [newbie] SSL Handshake

Hi, 

I have implemented a basic enough server using Simple, it is located at
http://mambaweb.sourceforge.net/, this implements the server with SSL
connections. You can find the source for it within the mamba-1.1.jar
file.

Niall

On Tue, 2004-04-27 at 09:09, bagas wrote:
> Dear all,
> 
>  
> 
> How can I make a web server that needed Client Keystore for making SSL
> Handshake process??
> 
>  
> 
> Thank you
> 
>  
> 
>  
> 
> Rahmat Bagas Santoso.
> 
> 

-------------------------------------------------------
This SF.net email is sponsored by: The Robotic Monkeys at ThinkGeek
For a limited time only, get FREE Ground shipping on all orders of $35
or more. Hurry up and shop folks, this offer expires April 30th!
http://www.thinkgeek.com/freeshipping/?cpg=12297
_______________________________________________
Simpleweb-Support mailing list
Sim...@li...
https://lists.sourceforge.net/lists/listinfo/simpleweb-support

Hi

> I have read mamba (http://mambaweb.sourceforge.net) source if I am not
> mistaken (please correct me if I am wrong) it only use server
> authentication so that the client can verify that the site is who and
> what it claims to be. 

This is true, the SSL/TLS protocol however requires an exchange of keys
so the client application must provide its public key. How it provides
this key and/or certifies itself is a client specific question. Try
looking at the JSSE documentation at http://java.sun.com/products/jsse/.

However, I think that client certificates are not really that important.
If you think the client might be bogus then use HTTP authentication over
SSL to authenticate your users, this is much easier and is supported in
the Simple API.

Niall